A manager's responsibility is to manage risk.
When a cross-scripting security hole was discovered in Gmail, this presented a very critical risk that the team quickly worked to resolve. Because there are millions of Gmail users, if I wrote a Web application that exploited this flaw, there would be a good chance that users of my Web application may be using Gmail and may have it open in another tab. Thus, as a phisher, it may be worth it to me to build such an application to gain access to user data.
The question your manager may be asking himself or herself is this: How risky is this security hole? What is the likelihood that there is a Web application out there that is targeting this particular security hole on this particular site? What is the risk that employees who are visiting our Website are also using this third-party website?
In my experience, if your site isn't getting a ton of traffic, then there isn't a ton of risk.
Your boss may be thinking that the opportunity cost of not fixing this particular security hole which may or may not be a problem, is that he or she instead can focus resources on activities that will help grow the business and generate revenue.
With that said, there was an issue very similar to this where Github was hacked, and there is a question on Project Management SE that covers this topic from a project management perspective. The user who hacked Github was in a similar situation as you, and his Github privileges were suspended for a time period.
My question to you is this: What happens to your business if the site does go down? What is the likelihood that you'll even see this security hole exploited?
If you do choose to pursue this, you'll need to objectively obtain evidence that this is a very real, imminent threat to the viability of the business.
Here are some suggestions for obtaining evidence that this is a real problem:
Perform Google searches looking for news articles, blogs or other experiences of companies that have experienced major issues as a result of a similar, related security hole. Demonstrate that this is indeed a risk that is worth addressing in lieu of other business opportunities.
Discuss with other technical personnel on the team and get their insight. If the issue is really severe, you should be able to find others who can back you up as well. If not, then either your concerns are not warranted or you have major issues in security in your company culture.
Discuss other options with your IT department for patching the hole that involve quicker-fix solutions that -- although not ideal -- may mitigate the risk and give you some peace of mind without breaking the corporate piggy bank. Sometimes a small amount of work can help eliminate some of the risk, if not all.
If the above points don't work, then my consider letting this go, and know that these issues are just going to be a normal part of business risk management.
